@lincoln504/pi-research 1.3.1 → 1.3.3

package/src/cleanup/research-cleanup.ts

@@ -3,7 +3,6 @@
  *
  * Handles cleanup operations for research sessions:
  * - Terminal input draining to prevent protocol response leaks
- * - Wave animation timer cleanup
  * - Session and panel cleanup
  * - Shared links cleanup
  */
@@ -17,7 +16,6 @@ import {
 } from '../orchestration/session-state.ts';
 import { cleanupSharedLinks } from '../utils/shared-links.ts';
 import type { CleanupContext } from '../types/index.ts';
-import type { ResearchPanelState } from '../types/research-panel-types.ts';
 
 export type { CleanupContext };
 
@@ -38,16 +36,13 @@ export function createCleanupFunction(
     researchId,
     piSessionId,
     masterWidgetId,
-    panelState,
-    waveTimer,
     unsubOrder,
   } = cleanupCtx;
-  
+
   const { ctx } = deps;
-  
+
   let cleanupCalled = false;
-  let waveTimerRef = waveTimer;
-  
+
   // Use reference objects to allow updating after creation
   const unsubOrderContainer = cleanupCtx.unsubOrderRef || { value: unsubOrder };
   
@@ -60,14 +55,6 @@ export function createCleanupFunction(
     if (cleanupCalled) return;
     cleanupCalled = true;
 
-    // Clear wave animation timer
-    if (waveTimerRef) {
-      clearInterval(waveTimerRef);
-      waveTimerRef = null;
-      panelState.waveFrame = undefined;
-      panelState.waveColors = undefined;
-    }
-
     if (unsubOrderContainer.value) {
       unsubOrderContainer.value();
       unsubOrderContainer.value = null;
@@ -119,13 +106,6 @@ export function createCleanupFunction(
   };
 }
 
-/**
- * Update the wave timer reference in the cleanup context
- */
-export function updateWaveTimer(cleanupCtx: CleanupContext, timer: NodeJS.Timeout | null): void {
-  (cleanupCtx as CleanupContext & { waveTimer?: NodeJS.Timeout | null }).waveTimer = timer;
-}
-
 /**
  * Update the unsubOrder reference in the cleanup context
  */
@@ -133,16 +113,4 @@ export function updateUnsubOrder(cleanupCtx: CleanupContext, unsub: (() => void)
   if (cleanupCtx.unsubOrderRef) {
     cleanupCtx.unsubOrderRef.value = unsub;
   }
-}
-
-/**
- * Stop and clear wave animation
- */
-export function stopWaveAnimation(panelState: ResearchPanelState): void {
-  if (panelState.waveTimer) {
-    clearInterval(panelState.waveTimer);
-    panelState.waveTimer = null;
-  }
-  panelState.waveFrame = undefined;
-  panelState.waveColors = undefined;
 }

package/src/cli.ts

@@ -41,7 +41,7 @@ import { RESEARCH_STOPPED_ERROR_CODE } from './orchestration/session-state.ts';
 import { validateAndSanitizeQuery } from './utils/input-validation.ts';
 import { validateInitialLink, MAX_INITIAL_LINKS } from './utils/url-utils.ts';
 import { exportResearchReport, appendExportMessage } from './utils/research-export.ts';
-import { getConfig, getGlobalConfigDir, getGlobalEnvFilePath, getInterfaceEnvFilePath, saveConfig, resetConfig, describeKnowledgeStoreMode, isProjectScopedKey, parseDotEnv } from './config.ts';
+import { getConfig, getGlobalConfigDir, getGlobalEnvFilePath, getInterfaceEnvFilePath, getStateDir, saveConfig, resetConfig, describeKnowledgeStoreMode, isProjectScopedKey, parseDotEnv } from './config.ts';
 import { getAgentDir } from '@earendil-works/pi-coding-agent';
 import { buildModelRegistry, safeGetAvailable } from './core/llm/model-registry-factory.ts';
 
@@ -327,7 +327,7 @@ function resolvedConfigPaths(): ResolvedConfigPaths {
     piIfaceEnv: getInterfaceEnvFilePath('pi'),
     piAuth: path.join(agentDir, 'auth.json'),
     piModels: path.join(agentDir, 'models.json'),
-    piState: process.env['PI_RESEARCH_STATE_DIR'] ?? path.join(getGlobalConfigDir(), 'state'),
+    piState: getStateDir(),
   };
 }
 
@@ -695,6 +695,13 @@ export async function cmdKnowledge(queries: string[], json?: boolean): Promise<n
 
   let result: KnowledgeSearchResult;
   let exit: number = EXIT.OK;
+  // Same rationale as cmdResearch: without wiring a signal in, Ctrl-C only tears
+  // down shared SDK services (safeShutdown, fired from onSignal) while this
+  // search keeps running unsignaled underneath it — a race that can either
+  // surface as a confusing mid-teardown failure or, worse, let the search
+  // resolve normally and report ok:true/exit 0 for an interrupted run.
+  const abortController = new AbortController();
+  activeResearchAbortController = abortController;
   try {
     await initResearchSDK({
       model: det.model,
@@ -704,10 +711,11 @@ export async function cmdKnowledge(queries: string[], json?: boolean): Promise<n
       ignoreGlobalConfig: true,
     });
     toStderr(`[pi-research] searching knowledge store (${queries.length} query/${queries.length === 1 ? '' : 's'})…\n`);
-    result = await searchKnowledge(queries);
+    result = await searchKnowledge(queries, abortController.signal);
   } catch (err) {
     return reportError(err, 'knowledge search', json);
   } finally {
+    if (activeResearchAbortController === abortController) activeResearchAbortController = null;
     await safeShutdown();
   }
 

package/src/config.ts

@@ -247,6 +247,33 @@ const USER_MIGRATION_KEYS = [
 // Centralized Project Settings Storage
 // ============================================================================
 
+/**
+ * Returns the state directory: PI_RESEARCH_STATE_DIR if set and absolute,
+ * otherwise ~/.pi/research/state.
+ *
+ * A relative override is deliberately ignored (falls back to the default)
+ * rather than resolved against process.cwd(): this directory backs
+ * cross-process coordination (browser-server/embedding-server leader
+ * election, the GPU lock, the run semaphore) that requires every process —
+ * the CLI invoked from an arbitrary cwd, the pi extension host, cluster
+ * worker processes — to agree on the exact same path. Resolving relative to
+ * whichever cwd a given process happens to be launched from would silently
+ * fragment that coordination into several independent, non-communicating
+ * state directories. scripts/cleanup.cjs already treats a relative override
+ * the same way (falls back to the default rather than guessing a cwd) —
+ * this keeps every reader in agreement with what deletion tooling assumes.
+ */
+export function getStateDir(): string {
+  const override = process.env['PI_RESEARCH_STATE_DIR'];
+  if (override) {
+    if (path.isAbsolute(override)) return override;
+    logger.warn(
+      `[config] PI_RESEARCH_STATE_DIR must be an absolute path — ignoring relative value "${override}" and using the default state directory.`,
+    );
+  }
+  return path.join(getGlobalConfigDir(), 'state');
+}
+
 /**
  * Returns the path to the centralized project settings file.
  */
@@ -254,9 +281,7 @@ export function getProjectSettingsRegistryPath(): string {
   // State lives under pi-research's OWN namespace (~/.pi/research/state), beside
   // config.env and knowledge_db — not in the host pi config dir root (~/.pi/state),
   // which would pollute and risk colliding with the host's own state.
-  const stateDir = process.env['PI_RESEARCH_STATE_DIR']
-    ?? path.join(getGlobalConfigDir(), 'state');
-  return path.join(stateDir, 'project-settings.json');
+  return path.join(getStateDir(), 'project-settings.json');
 }
 
 /**

package/src/core/interfaces/state-manager-interfaces.ts

@@ -16,7 +16,6 @@ export interface IStateManager extends IService {
   updateHeartbeat(sessionId: string): Promise<void>;
   cleanupStaleSessions(timeoutMs: number): Promise<number>;
   getBrowserServer(): Promise<{ port: number; pid: number; schedulerId?: string; authSecret?: string } | null>;
-  setBrowserServer(port: number, pid: number, schedulerId?: string, authSecret?: string): Promise<void>;
   // `expected` makes the clear a compare-and-delete: the entry is only removed when
   // the provided identity fields match, so a stale caller cannot deregister a leader
   // it does not own. Omit only when the caller has just verified ownership under the

package/src/core/llm/agentic-repair.ts

@@ -63,7 +63,11 @@ export type LlmCompleter = (
 export async function repairJsonWithLlm<T = any>(
   text: string,
   completer: LlmCompleter,
-  auth: { apiKey: string; headers?: Record<string, string> },
+  // headers values are string | null to match pi-ai's ProviderHeaders — a null
+  // entry suppresses a provider/API default header with that name, and is
+  // forwarded to `completer`'s SimpleStreamOptions.headers unchanged, where
+  // pi-ai already treats it as documented.
+  auth: { apiKey: string; headers?: Record<string, string | null> },
   options: JsonRepairOptions
 ): Promise<T | null> {
   const { model, context, schema, serviceName = 'RepairService', signal, maxTokens = 16384, thinkingLevel = 'off' } = options;

package/src/core/llm/model-registry-factory.ts

@@ -36,9 +36,15 @@ export interface ModelRegistryLike {
  * Structural result of {@link ModelRegistryLike.getApiKeyAndHeaders}. Mirrors the
  * pi-coding-agent `ApiKeyAndHeaders` discriminated union without importing it, so
  * a host skew on the concrete type can't break our build.
+ *
+ * `headers` values are `string | null` (not just `string`) as of pi 0.84.0's
+ * `ProviderHeaders` type — `null` is a legitimate header-DELETION marker (e.g.
+ * stripping a placeholder credential before it reaches a gateway), not an
+ * absent value. Every consumer of `headers` below must treat `null` as "omit
+ * this header," not coerce it to the literal string `"null"`.
  */
 export type AuthResultLike =
-  | { ok: true; apiKey?: string; headers?: Record<string, string> }
+  | { ok: true; apiKey?: string; headers?: Record<string, string | null> }
   | { ok: false; error: string };
 
 /** Safe `getAll()` — returns [] if the host registry lacks the method. */
@@ -156,12 +162,16 @@ export async function buildModelRegistry(apiKey?: string, provider?: string): Pr
   // with an explicit model (enforced in cli.ts pre-flight), so resolution never
   // falls back to "first available".
   if (apiKey && provider) {
-    // allowNetwork:false is REQUIRED here, not just consistent with create():
-    // setRuntimeApiKey triggers a model-catalog refresh for the newly configured
-    // provider, and its default options open live catalog connections — verified
-    // to hang indefinitely (no timeout at this layer) in network-restricted
-    // environments, which would wedge every explicit-API-key pre-flight.
-    await runtime.setRuntimeApiKey(provider, apiKey, { allowNetwork: false });
+    // pi 0.84.0 removed `allowNetwork` from setRuntimeApiKey's own options
+    // (AuthOperationOptions is now just `{ signal? }`) — but its internal
+    // synchronizeCredentialState() now hardcodes `refresh({ allowNetwork:
+    // false, ... })` unconditionally on every call, so the "no live catalog
+    // connection, no indefinite hang in network-restricted environments"
+    // guarantee this call originally needed still holds without asking for
+    // it. Confirmed by reading pi-coding-agent's model-runtime.js directly,
+    // not just the changelog prose — verify this again on the next pi bump
+    // before assuming it's still unconditional.
+    await runtime.setRuntimeApiKey(provider, apiKey);
   }
 
   // The sync facade all our resolvers consume. getAvailable()/getApiKeyAndHeaders()

package/src/core/pi-version.ts

@@ -61,8 +61,21 @@ export function compareVersions(a: SemverParts, b: SemverParts): number {
  * `ModelRegistry.create()`. `buildModelRegistry` calls `ModelRuntime.create()`
  * unconditionally, and `createAgentSession()` is invoked without the removed
  * `modelRegistry` option, relying on the 0.80.8+ host to build its own.
+ *
+ * 0.84.0 removed `allowNetwork` from `ModelRuntime.setRuntimeApiKey()`'s own
+ * options (`AuthOperationOptions` is now just `{ signal? }`) — but its
+ * internal `synchronizeCredentialState()` now hardcodes `refresh({
+ * allowNetwork: false, ... })` unconditionally on every call, so
+ * `buildModelRegistry`'s explicit-API-key path (model-registry-factory.ts)
+ * no longer passes `allowNetwork` at all, RELYING on 0.84.0+'s own
+ * unconditional internal guard against a live network catalog connection.
+ * On an already-resolved pre-0.84.0 host, `setRuntimeApiKey`'s default
+ * (unspecified) network behavior applies instead — reintroducing the
+ * indefinite-hang-in-network-restricted-environments bug that explicit
+ * option originally existed to prevent. The floor moved to close that gap,
+ * not just because the type changed.
  */
-export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 80, patch: 8 };
+export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 84, patch: 0 };
 
 /**
  * Newest host line this release was actually exercised against (CI + a real run).
@@ -70,7 +83,7 @@ export const PI_MIN_VERSION: SemverParts = { major: 0, minor: 80, patch: 8 };
  * Compared on MAJOR.MINOR only: a patch bump within a tested line is not a new
  * surface, and warning on it would be noise.
  */
-export const PI_TESTED_MAX_VERSION: SemverParts = { major: 0, minor: 83, patch: 0 };
+export const PI_TESTED_MAX_VERSION: SemverParts = { major: 0, minor: 84, patch: 1 };
 
 export type PiCompatibilityLevel = 'ok' | 'unparseable' | 'too-old' | 'untested';
 

package/src/core/service-registry.ts

@@ -90,6 +90,13 @@ interface ServiceRegistration<T extends IService> {
   factory: ServiceFactory<T>;
   instance: T | null;
   initializationPromise: Promise<T> | null;
+  // A clear()/replace() disposal currently tearing this service's instance
+  // down. get() awaits this before touching registration.instance — without
+  // it, a concurrent get() arriving mid-disposal (instance still non-null;
+  // dispose() hasn't nulled it yet) would either re-initialize the very
+  // instance being disposed (ctx branch) or hand a caller a reference that's
+  // about to be (or already was) torn down.
+  disposalPromise: Promise<void> | null;
   options: ServiceContainerOptions;
 }
 
@@ -153,6 +160,7 @@ export class ServiceContainer {
       factory,
       instance: null,
       initializationPromise: null,
+      disposalPromise: null,
       options: mergedOptions,
     });
     
@@ -216,6 +224,16 @@ export class ServiceContainer {
       throw new Error(`Service '${name}' is not registered`);
     }
 
+    // A clear()/replace() disposal in flight must settle before anything below
+    // reads registration.instance — otherwise this call could re-initialize
+    // (ctx branch) or hand back a reference to the very instance currently
+    // being torn down. while(), not if(): a newer disposal can start again
+    // while we're awaiting (mirrors the initializationPromise wait pattern
+    // used throughout this method).
+    while (registration.disposalPromise) {
+      await registration.disposalPromise.catch(() => { /* disposal errors are logged by clear()/replace() */ });
+    }
+
     // Return existing instance if already initialized.
     if (registration.instance) {
       // `_initializeService` publishes `registration.instance` BEFORE awaiting the
@@ -255,12 +273,30 @@ export class ServiceContainer {
         // instance under a running initialize()), and concurrent callers
         // received the instance mid-re-initialization.
         registration.initializationPromise = reinit as Promise<IService>;
-        const clearIfCurrent = () => {
-          if (registration.initializationPromise === (reinit as Promise<IService>)) {
+        // Identity-guarded: only touch shared state if THIS reinit is still the
+        // one the registration is currently tracking — a newer reinit/init that
+        // superseded it (and already published its own result) must not be
+        // clobbered by a stale settlement arriving after it.
+        const isStillCurrent = () => registration.initializationPromise === (reinit as Promise<IService>);
+        reinit.then(
+          () => { if (isStillCurrent()) registration.initializationPromise = null; },
+          () => {
+            // A re-init failure can leave THIS SAME instance in an inconsistent
+            // internal state — e.g. KnowledgeStoreService disposes its old
+            // handles before rebuilding on a cwd/mode change, then can still
+            // throw mid-rebuild. Unlike a fresh _initializeService() failure
+            // (which nulls registration.instance so the next get() rebuilds via
+            // the factory), this path used to leave the registry believing the
+            // same now-broken object was still a valid instance indefinitely.
+            // Mirror _initializeService's own failure handling for consistency.
+            if (!isStillCurrent()) return;
             registration.initializationPromise = null;
-          }
-        };
-        reinit.then(clearIfCurrent, clearIfCurrent);
+            if (registration.instance) {
+              registration.instance.lifecycle = ServiceLifecycle.UNINITIALIZED;
+              registration.instance = null;
+            }
+          },
+        );
         return reinit;
       }
       return registration.instance as T;
@@ -344,27 +380,45 @@ export class ServiceContainer {
       throw new Error(`Service '${name}' is not registered`);
     }
 
-    // Settle an in-flight initialization first. Disposing the early-published
-    // instance while its initialize() is still running hands the awaiting get()
-    // caller a service that was disposed under it — observed as store-closed
-    // errors when /research-config cleared the knowledge store during a
-    // concurrent first search.
-    if (registration.initializationPromise) {
-      await registration.initializationPromise.catch(() => { /* failed init cleaned up after itself */ });
+    // Join an already-in-flight clear()/replace() rather than starting a
+    // second disposal of the same registration.
+    if (registration.disposalPromise) {
+      return registration.disposalPromise;
     }
 
-    if (registration.instance && registration.instance.dispose) {
-      await registration.instance.dispose().catch((err: unknown) => {
-        logger.warn(`[ServiceContainer] Error disposing service '${name}':`, err);
-      });
-    }
+    // Published for the whole body (not just the dispose() call below) so a
+    // concurrent get() — which now awaits this before touching
+    // registration.instance — cannot slip in during the init-settle wait
+    // either, not only during the dispose() call itself.
+    registration.disposalPromise = (async () => {
+      try {
+        // Settle an in-flight initialization first. Disposing the early-published
+        // instance while its initialize() is still running hands the awaiting get()
+        // caller a service that was disposed under it — observed as store-closed
+        // errors when /research-config cleared the knowledge store during a
+        // concurrent first search.
+        if (registration.initializationPromise) {
+          await registration.initializationPromise.catch(() => { /* failed init cleaned up after itself */ });
+        }
+
+        if (registration.instance && registration.instance.dispose) {
+          await registration.instance.dispose().catch((err: unknown) => {
+            logger.warn(`[ServiceContainer] Error disposing service '${name}':`, err);
+          });
+        }
 
-    registration.instance = null;
-    registration.initializationPromise = null;
+        registration.instance = null;
+        registration.initializationPromise = null;
 
-    if (registration.options.enableLogging) {
-      logger.debug(`[ServiceContainer] Cleared service '${name}'`);
-    }
+        if (registration.options.enableLogging) {
+          logger.debug(`[ServiceContainer] Cleared service '${name}'`);
+        }
+      } finally {
+        registration.disposalPromise = null;
+      }
+    })();
+
+    return registration.disposalPromise;
   }
 
   /**
@@ -376,24 +430,38 @@ export class ServiceContainer {
       throw new Error(`Service '${name}' is not registered`);
     }
 
-    // Settle an in-flight initialization before swapping — see clear().
-    if (registration.initializationPromise) {
-      await registration.initializationPromise.catch(() => { /* failed init cleaned up after itself */ });
+    // Join an already-in-flight clear()/replace() — see clear().
+    if (registration.disposalPromise) {
+      await registration.disposalPromise;
     }
 
-    // Dispose old instance if present
-    if (registration.instance && registration.instance.dispose) {
-      await registration.instance.dispose().catch((err: unknown) => {
-        logger.warn(`[ServiceContainer] Error disposing old service '${name}':`, err);
-      });
-    }
+    // Published for the whole body — see clear()'s comment for why.
+    registration.disposalPromise = (async () => {
+      try {
+        // Settle an in-flight initialization before swapping — see clear().
+        if (registration.initializationPromise) {
+          await registration.initializationPromise.catch(() => { /* failed init cleaned up after itself */ });
+        }
 
-    registration.instance = newInstance;
-    registration.initializationPromise = null;
+        // Dispose old instance if present
+        if (registration.instance && registration.instance.dispose) {
+          await registration.instance.dispose().catch((err: unknown) => {
+            logger.warn(`[ServiceContainer] Error disposing old service '${name}':`, err);
+          });
+        }
 
-    if (registration.options.enableLogging) {
-      logger.debug(`[ServiceContainer] Replaced service '${name}'`);
-    }
+        registration.instance = newInstance;
+        registration.initializationPromise = null;
+
+        if (registration.options.enableLogging) {
+          logger.debug(`[ServiceContainer] Replaced service '${name}'`);
+        }
+      } finally {
+        registration.disposalPromise = null;
+      }
+    })();
+
+    return registration.disposalPromise;
   }
 
   /**

package/src/infrastructure/browser/thread-worker-browser.ts

@@ -18,6 +18,19 @@ let context: any = null;
 let initPromise: Promise<void> | null = null;
 let workerId: string = '';
 
+// How many tasks this worker process currently has in flight. poolifier's
+// tasksQueueOptions.concurrency (WORKER_CONCURRENCY, default 2 — see
+// worker-pool-manager.ts) dispatches more than one task at a time to the SAME
+// worker process, and every dispatched task shares this module's browser/
+// context singletons (each gets its own page via createPageSafe(context), but
+// the context/browser themselves are one shared instance). resetBrowser()
+// uses this to avoid tearing that shared instance down out from under a
+// sibling task that is still actively using it — see resetBrowser() below.
+let activeTaskCount = 0;
+// A reset that resetBrowser() deferred because sibling tasks were still
+// active, to be applied once the last one finishes.
+let resetPending = false;
+
 /**
  * Set the worker ID for logging purposes
  */
@@ -25,6 +38,20 @@ export function setWorkerId(id: string): void {
   workerId = id;
 }
 
+/** Call when a task begins executing (before it touches the browser/context). */
+export function taskStarted(): void {
+  activeTaskCount++;
+}
+
+/** Call when a task finishes (success or failure), from a `finally` block. */
+export function taskFinished(): void {
+  activeTaskCount = Math.max(0, activeTaskCount - 1);
+  if (activeTaskCount === 0 && resetPending) {
+    resetPending = false;
+    doResetBrowser();
+  }
+}
+
 /**
  * Check if browser is connected
  */
@@ -247,16 +274,38 @@ export function getContext(): any {
   return context;
 }
 
-/**
- * Reset browser and context (used after crashes)
- */
-export function resetBrowser(): void {
+function doResetBrowser(): void {
   if (context) Promise.resolve(context.close()).catch((err: Error) => logToDebugFile('DEBUG', `[Worker-${workerId}] Swallowed context close error during reset: ${err.message}`));
   if (browser) Promise.resolve(browser.close()).catch((err: Error) => logToDebugFile('DEBUG', `[Worker-${workerId}] Swallowed browser close error during reset: ${err.message}`));
   context = null;
   browser = null;
 }
 
+/**
+ * Reset browser and context (used after crashes).
+ *
+ * A page/session-scoped failure in ONE task (e.g. Playwright/Juggler's
+ * generic "Protocol error", thrown for a single crashed tab — not
+ * necessarily the whole browser) must not tear down the browser/context a
+ * CONCURRENTLY-RUNNING sibling task is still actively using (see
+ * activeTaskCount's doc comment): that collaterally fails the sibling's
+ * perfectly healthy work with a spurious "browser closed" error, un-retried.
+ *
+ * If other tasks are still in flight, defer instead of resetting immediately
+ * — the deferred reset runs once the last active task finishes (taskFinished
+ * above). A GENUINELY dead browser is still caught regardless: initBrowser()'s
+ * own isBrowserConnected() check on the very next task re-initializes either
+ * way, so deferring costs nothing in that case — it just avoids the
+ * collateral damage in the much more common single-crashed-tab case.
+ */
+export function resetBrowser(): void {
+  if (activeTaskCount > 1) {
+    resetPending = true;
+    return;
+  }
+  doResetBrowser();
+}
+
 /**
  * Clean up browser resources with a timeout to prevent hanging
  */

package/src/infrastructure/browser/thread-worker.mjs

@@ -45,7 +45,12 @@ function formatArg(arg) {
   return String(arg);
 }
 function redactSecrets(message) {
-  let out = message.length > MAX_LOG_MESSAGE_LENGTH ? `${message.slice(0, MAX_LOG_MESSAGE_LENGTH)}\u2026[truncated ${message.length - MAX_LOG_MESSAGE_LENGTH} chars]` : message;
+  let keep = MAX_LOG_MESSAGE_LENGTH;
+  if (message.length > keep) {
+    const lastKeptUnit = message.charCodeAt(keep - 1);
+    if (lastKeptUnit >= 55296 && lastKeptUnit <= 56319) keep -= 1;
+  }
+  let out = message.length > MAX_LOG_MESSAGE_LENGTH ? `${message.slice(0, keep)}\u2026[truncated ${message.length - keep} chars]` : message;
   out = out.replace(ANSI_PATTERN, "");
   out = out.replace(URL_CREDENTIALS_PATTERN, "$1[REDACTED]@");
   out = out.replace(JWT_PATTERN, "[REDACTED]");
@@ -1483,6 +1488,7 @@ function isBenignScrapeFailure(error) {
   const msg = error instanceof Error ? error.message : String(error);
   return msg.startsWith("Fetch blocked:") || // bot-protection interstitial (Cloudflare, DDoS-Guard, …)
   msg.startsWith("Fetch returned stub:") || // nav-only / near-empty page
+  msg.startsWith("Could not extract content from PDF") || // malformed/encrypted/scanned-only PDF
   /^HTTP \d{3}\b/.test(msg) || // remote 4xx/5xx status
   isCloudflareBlockError(error) || isTaskTimeoutError(error) || isPoolShutdownError(error);
 }
@@ -2500,9 +2506,21 @@ var browser = null;
 var context = null;
 var initPromise = null;
 var workerId3 = "";
+var activeTaskCount = 0;
+var resetPending = false;
 function setWorkerId3(id) {
   workerId3 = id;
 }
+function taskStarted() {
+  activeTaskCount++;
+}
+function taskFinished() {
+  activeTaskCount = Math.max(0, activeTaskCount - 1);
+  if (activeTaskCount === 0 && resetPending) {
+    resetPending = false;
+    doResetBrowser();
+  }
+}
 var isBrowserConnected = () => {
   try {
     return browser && typeof browser.isConnected === "function" && browser.isConnected();
@@ -2628,12 +2646,19 @@ async function initBrowser() {
 function getContext() {
   return context;
 }
-function resetBrowser() {
+function doResetBrowser() {
   if (context) Promise.resolve(context.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed context close error during reset: ${err.message}`));
   if (browser) Promise.resolve(browser.close()).catch((err) => logToDebugFile3("DEBUG", `[Worker-${workerId3}] Swallowed browser close error during reset: ${err.message}`));
   context = null;
   browser = null;
 }
+function resetBrowser() {
+  if (activeTaskCount > 1) {
+    resetPending = true;
+    return;
+  }
+  doResetBrowser();
+}
 async function cleanupBrowser2() {
   const timeoutMs = 2e3;
   const cleanup = async () => {
@@ -2695,6 +2720,7 @@ async function runTask(data) {
   if (taskTimeoutMs && taskTimeoutMs > 0) {
     taskTimer = setTimeout(() => abortController.abort(new Error(`Task timed out after ${taskTimeoutMs}ms`)), taskTimeoutMs);
   }
+  taskStarted();
   try {
     await initBrowser();
     const initMs = Date.now() - startTime;
@@ -2731,6 +2757,7 @@ async function runTask(data) {
     };
   } finally {
     if (taskTimer !== void 0) clearTimeout(taskTimer);
+    taskFinished();
   }
 }
 var worker = new ClusterWorker(runTask, {

package/src/infrastructure/browser/thread-worker.ts

@@ -26,6 +26,8 @@ import {
   getContext,
   resetBrowser,
   cleanupBrowser,
+  taskStarted,
+  taskFinished,
 } from './thread-worker-browser.ts';
 import {
   setWorkerId as setMessagingWorkerId,
@@ -102,6 +104,11 @@ async function runTask(data: TaskData | undefined): Promise<TaskResult> {
     taskTimer = setTimeout(() => abortController.abort(new Error(`Task timed out after ${taskTimeoutMs}ms`)), taskTimeoutMs);
   }
 
+  // Registered around the whole browser-touching lifetime of this task so
+  // resetBrowser() (below) can tell whether a sibling task dispatched to this
+  // same worker process (WORKER_CONCURRENCY > 1) is still using the shared
+  // browser/context before tearing it down.
+  taskStarted();
   try {
     await initBrowser();
     const initMs = Date.now() - startTime;
@@ -149,6 +156,7 @@ async function runTask(data: TaskData | undefined): Promise<TaskResult> {
     };
   } finally {
     if (taskTimer !== undefined) clearTimeout(taskTimer);
+    taskFinished();
   }
 }